securekomodo Goto Github PK

ahmyth-android-rat

Android Remote Administration Tool

apache-log4j-poc

Apache Log4j 远程代码执行

awesome-pentest

A collection of awesome penetration testing resources, tools and other shiny things

awesome-sec-s3

A collection of awesome AWS S3 tools that collects and enumerates exposed S3 buckets

azure-red-team

Azure Security Resources and Notes

azuread-incident-response

Notes on responding to security breaches relating to Azure AD

bac-tract

Extract data from bacpac files

checkhostsinscope

Bash script to take a list of domains/subdomains (e.g. from amass) and check if they're in scope based on a file of inscope IP addresses

citrixinspector

Accurately fingerprint and detect vulnerable (and patched!) versions of Netscaler / Citrix ADC to CVE-2023-3519

cloud_enum

Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

cloudpentestcheatsheets

This repository contains a collection of cheatsheets I have put together for tools related to pentesting organizations that leverage cloud providers.

covenant

Covenant is a collaborative .NET C2 framework for red teamers.

credphish

CredPhish is a PowerShell script designed to invoke legitimate credential prompts and exfiltrate passwords over DNS.

cve-2021-44228-log4shell-hashes

Hashes for vulnerable LOG4J versions

cve-2022-26134

CVE-2022-26134 Proof of Concept

cve-2023-38035

Ivanti Sentry Exploit POC CVE-2023-38035

cve-2024-22026

Exploit POC for CVE-2024-22026 affecting Ivanti EPMM "MobileIron Core"

discovery

domainpasswordspray

DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!

eyewitness

EyeWitness is designed to take screenshots of websites, provide some server header info, and identify default credentials if possible.

fbctf

Platform to host Capture the Flag competitions

fireprox

AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation

googlectf

inceptor

Template-Driven AV/EDR Evasion Framework

linkedin-employee-scraper

Extracat all employees from LinkedIn. Especially useful for companies with thousands of employees.

linkedin-timestamp

LinkedIn Timestamp Tool is a Python script that extracts the exact date and time a LinkedIn post was created from its URL. This information is valuable for Open Source Intelligence (OSINT) investigations and penetration testing scenarios.

linkedint

LinkedIn Recon Tool

lists

Lists of things

log4j-scan

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

machinec2

MΛCHIПE C2 is a Cross-platform HTTPS Command & Control (C2) Server written in PHP